index future date events as today's date in _time

[ayush1906]

I am getting a future timestamped event, but I want to index it as default time of index. i.e. at the time when it got indexed.

Presently I have changed

MAX_DAYS_HENCE = 0

in my props.conf. But I found out that the event having tomorrow's date are getting index with tomorrow's date instead of today's date.

Like today its 23 July, I am looking for any events after today to be indexed for time 23 July. But in my case 24 July is taken as a valid date which should not be the case.

Any other workaround would be appreciated.

The source data is JSON response of API which I am indexing via python script and taking PED field as _time

[adonio · Accepted solution]

in props.conf use:
DATETIME_CONFIG = CURRENT

read here:
https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Configuretimestamprecognition#Timestamp_vali...